8 ms·
Full System Control with New SolarWinds Orion and Serv-U FTP Vulnerabilities
- malux85 6y agoUnauthenticated queue, with unsafe deserialisation, running as the system account. Amateur hour
- uncledave 6y agoThat’s almost as bad as the time Microsoft ran Defender sandbox as LocalSystem. CVE-2017-0290. That one was a massive dose of irony in one CVE. You’d think people would have learned about least privilege by now?
- deleted 6y ago[deleted]
- paulie_a 6y agoIt's why it's the preferred server in the warez scene
- codetrotter 6y agoDo they still break into other peoples servers instead of renting their own?
- js4ever 6y agoOf course! Renting their own will make them easier to find
- codetrotter 6y agoThey could pay with a privacy-minded cryptocurrency though. Like Monero or something.
- paulie_a 6y agoI am assuming it is still like the old days. A sysadmin drops an ftp server onto some box/vm at a company and no one notices
- chrisco255 6y agoThis same FTP server powers Dominion Voting Systems, which controls a huge share of the election infrastructure in the U.S. https://dvsfileshare.dominionvoting.com/Web%20Client/Mobile/MLogin.htm https://dvsfileshare.dominionvoting.com/Web%20Client/Mobile/...
- blhack 6y agoCan you elaborate on why you think this is relevant?
- deleted 6y ago[deleted]
- leesalminen 6y agoCan you elaborate on why you think this isn’t relevant? It seems plainly obvious to me how it’s relevant.
- thefreeman 6y agoDoes the FTP server print out paper ballots which voters then review and manually scan in a machine? If not then it's totally irrelevant.
- chrisco255 6y agoDominion works off of dongles and file transfers. If you're curious about the DVS topology: https://www.sos.state.co.us/pubs/elections/VotingSystems/systemsDocumentation/DominionDocumentation.html https://www.sos.state.co.us/pubs/elections/VotingSystems/sys...
- tw04 6y agoFor early voting reports. Paper ballots are tallied for official results. A vulnerability in the FTP software, which I don't believe you've provided any proof was actually exploited in the wild during the elections, makes 0 difference to official results.
- a-dub 6y agothe serv-u thing looks like a misconfiguration to me. i'd be curious how many installs in the wild are actually vulnerable. ie. 1) was there a previous install process that did set correct permissions for the access list tree? 2) did sites secure the access list tree themselves after install/security review? the msmq thing isn't great, but any professionally managed site would be protecting/firewalling application level sockets anyhow. not to say the bugs aren't real, they are, just wondering how much exposure they actually open up in the wild when combined with basic security hygiene.
- tyingq 6y agoTheir hotfix seems to acknowledge that the software is specifically setting weak ACLs on that C:\Program Data\RhinoSoft\Serv-U\Users directory. You're right that end users should do "2)", but I imagine it's pretty common to just run the installer.
- a-dub 6y agothe name of the previous developer (rhinosoft) of the software appears in the directory tree, which would lead me to guess that maybe the original installer did set correct ACLs but when ported to the new post-acquisition solarwinds installer, that was maybe dropped. (just a guess) i dunno how modern windows admin is done, but the last time i worked with it it was common for large sites to use deployment automation and do repackaging, even if was less sophisticated than what you'd see in unixland.
- john37386 6y agoYou can maybe ask shodan? https://www.shodan.io/search?query=serv-u https://www.shodan.io/search?query=serv-u
- ficklepickle 6y ago220 Serv-U FTP Server v6.3 for WinSock ready... https://www.shodan.io/search?query=serv-u+ftp https://www.shodan.io/search?query=serv-u+ftp
- 6y ago
- john37386 6y agoThere is a deterrent disclaimer https://dvsfileshare.dominionvoting.com/ https://dvsfileshare.dominionvoting.com/ Access to this site is for authorized users only! All unauthorized use and access will be prosecuted to the fullest extent of the law. I'd be carefull before trying anything on that server. -edit: Added italic on the disclaimer
- vmception 6y agoI like when the hackers make complete disc images on docker and let people download those the hacker is the only one with any unauthorized access liability and all the other tinkerers have none from what I can tell
- Nextgrid 6y agoPeople that write such "deterrents" should dogfood their own stuff by replacing their door lock (or similar security measures - car keys, payment card PINs, etc) with such a disclaimer.
- deleted 6y ago[deleted]
- Haemm0r 6y agoI didn't know, that serv-u is still a thing. Last time I heard that name was like 10-15y ago, before bittorrent became the big thing. :)
- unixhero 6y agoServu is still being used in the wild??? 1998 called and wants its tech back.